Does Recaptcha v3 show graphical captchas at all?
I currently use invisible recaptcha and it automatically shows a captcha if it thinks the user is a bot.
Now there is Recaptcha v3 and I struggle to understand how it is supposed to be used.
It returns a score, but what if the score is low which may indicate the user is a robot. Should I then show the graphical captcha by calling some function? Or should I simply pop up a dialog that captcha thinks you're a bot and that's it?
So what I don't get: what should happen if the user gets a low score? Is there a way for the user to still proceed by solving a captcha? Or is it the end of the road then and there is no way to go forward?
Does/can recaptcha v3 show graphical captchas to solve at all?
recaptcha captcha
asked Nov 25 '18 at 8:28
TomTom
4,54742542
add a comment |
I currently use invisible recaptcha and it automatically shows a captcha if it thinks the user is a bot.
Now there is Recaptcha v3 and I struggle to understand how it is supposed to be used.
It returns a score, but what if the score is low which may indicate the user is a robot. Should I then show the graphical captcha by calling some function? Or should I simply pop up a dialog that captcha thinks you're a bot and that's it?
So what I don't get: what should happen if the user gets a low score? Is there a way for the user to still proceed by solving a captcha? Or is it the end of the road then and there is no way to go forward?
Does/can recaptcha v3 show graphical captchas to solve at all?
recaptcha captcha
asked Nov 25 '18 at 8:28
TomTom
4,54742542
add a comment |
I currently use invisible recaptcha and it automatically shows a captcha if it thinks the user is a bot.
Now there is Recaptcha v3 and I struggle to understand how it is supposed to be used.
It returns a score, but what if the score is low which may indicate the user is a robot. Should I then show the graphical captcha by calling some function? Or should I simply pop up a dialog that captcha thinks you're a bot and that's it?
So what I don't get: what should happen if the user gets a low score? Is there a way for the user to still proceed by solving a captcha? Or is it the end of the road then and there is no way to go forward?
Does/can recaptcha v3 show graphical captchas to solve at all?
recaptcha captcha
asked Nov 25 '18 at 8:28
TomTom
4,54742542
I currently use invisible recaptcha and it automatically shows a captcha if it thinks the user is a bot.
Now there is Recaptcha v3 and I struggle to understand how it is supposed to be used.
It returns a score, but what if the score is low which may indicate the user is a robot. Should I then show the graphical captcha by calling some function? Or should I simply pop up a dialog that captcha thinks you're a bot and that's it?
So what I don't get: what should happen if the user gets a low score? Is there a way for the user to still proceed by solving a captcha? Or is it the end of the road then and there is no way to go forward?
Does/can recaptcha v3 show graphical captchas to solve at all?
recaptcha captcha
recaptcha captcha
asked Nov 25 '18 at 8:28
TomTom
4,54742542
asked Nov 25 '18 at 8:28
TomTom
4,54742542
asked Nov 25 '18 at 8:28
TomTom
4,54742542
asked Nov 25 '18 at 8:28
TomTom
4,54742542
asked Nov 25 '18 at 8:28
TomTom
4,54742542
4,54742542
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The idea is no user friction, and displaying a captcha runs contrary to that. Recall that you should put ReCaptcha v3 on all pages, not only on those you want to protect: that’s how the captcha will learn to distinguish normal from abusive behaviors. A user must be always allowed to proceed. Low scores should be used to prioritize or further qualify requests.
For example, in analytics you may want to discard bot/scraper interactions with low scores. In commerce, you want to deprioritize bot orders – don’t count them in day’s sales, put them last in the queue and require human verification on your end, or an additional verification step i.e. an email challenge. In logins, low scores would force 2nd factor verification step. And so on – your question cannot be further answered without knowing the exact use for the page you ask about.
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53465827%2fdoes-recaptcha-v3-show-graphical-captchas-at-all%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The idea is no user friction, and displaying a captcha runs contrary to that. Recall that you should put ReCaptcha v3 on all pages, not only on those you want to protect: that’s how the captcha will learn to distinguish normal from abusive behaviors. A user must be always allowed to proceed. Low scores should be used to prioritize or further qualify requests.
For example, in analytics you may want to discard bot/scraper interactions with low scores. In commerce, you want to deprioritize bot orders – don’t count them in day’s sales, put them last in the queue and require human verification on your end, or an additional verification step i.e. an email challenge. In logins, low scores would force 2nd factor verification step. And so on – your question cannot be further answered without knowing the exact use for the page you ask about.
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
add a comment |
The idea is no user friction, and displaying a captcha runs contrary to that. Recall that you should put ReCaptcha v3 on all pages, not only on those you want to protect: that’s how the captcha will learn to distinguish normal from abusive behaviors. A user must be always allowed to proceed. Low scores should be used to prioritize or further qualify requests.
For example, in analytics you may want to discard bot/scraper interactions with low scores. In commerce, you want to deprioritize bot orders – don’t count them in day’s sales, put them last in the queue and require human verification on your end, or an additional verification step i.e. an email challenge. In logins, low scores would force 2nd factor verification step. And so on – your question cannot be further answered without knowing the exact use for the page you ask about.
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
add a comment |
The idea is no user friction, and displaying a captcha runs contrary to that. Recall that you should put ReCaptcha v3 on all pages, not only on those you want to protect: that’s how the captcha will learn to distinguish normal from abusive behaviors. A user must be always allowed to proceed. Low scores should be used to prioritize or further qualify requests.
For example, in analytics you may want to discard bot/scraper interactions with low scores. In commerce, you want to deprioritize bot orders – don’t count them in day’s sales, put them last in the queue and require human verification on your end, or an additional verification step i.e. an email challenge. In logins, low scores would force 2nd factor verification step. And so on – your question cannot be further answered without knowing the exact use for the page you ask about.
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
The idea is no user friction, and displaying a captcha runs contrary to that. Recall that you should put ReCaptcha v3 on all pages, not only on those you want to protect: that’s how the captcha will learn to distinguish normal from abusive behaviors. A user must be always allowed to proceed. Low scores should be used to prioritize or further qualify requests.
For example, in analytics you may want to discard bot/scraper interactions with low scores. In commerce, you want to deprioritize bot orders – don’t count them in day’s sales, put them last in the queue and require human verification on your end, or an additional verification step i.e. an email challenge. In logins, low scores would force 2nd factor verification step. And so on – your question cannot be further answered without knowing the exact use for the page you ask about.
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
answered Nov 25 '18 at 8:56
Kuba OberKuba Ober
70.5k983192
70.5k983192
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
add a comment |
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
Ah, so in v3 no captcha should be shown at all. On my page there are multiple links which run certain heavier computations, so I don't want a bot (or a crazy user) to click all the links. For this reason I currently run invisible recaptcha before running a computation behind a llink, because it only allows the operation to run if the user is either not a bot or passed the captcha. So a lower score does not really help me here, because if the score is low I still have to make sure the user is not a bot (passes the captcha), I only want to run it if the user passes the test.
– Tom
Nov 25 '18 at 9:26
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
A low score means you should re-authenticate the user, for example. Using visible captcha won’t be enough at that point: low score means that things aren’t right and without a strong indication that a human is present, you can simply discard the request. Showing a visible captcha will likely get answered by a human captcha farm, or something like that, and certainly won’t shield you from bots. Recaptcha v2 is susceptible to human captcha farms. Those are cheap and in widespread use. When v3 fails, you know that captcha has failed: further use of catcha is opening up doors to bots.
– Kuba Ober
Nov 25 '18 at 21:23
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
@KubaOber "Recaptcha v2 is susceptible to human captcha farms." How does v3 get around it? Presumably a human looks like a human to reCaptcha v3, otherwise it's not working!
– poshest
Nov 29 '18 at 10:18
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
"displaying a captcha runs contrary to that"... but this seems to mention, under the Personalization > "type" heading that challenges will be shown. Perhaps v3 only means no initial tick box?
– poshest
Nov 29 '18 at 10:45
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53465827%2fdoes-recaptcha-v3-show-graphical-captchas-at-all%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
